JWT algorithm confusion in Hono JWK Auth Middleware when JWK lacks "alg" (untrusted header.alg fallback)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-22818 · CVE overview and exploitation status

EUVD-2026-2017

GHSA-3vhc-576x-3qv4

cve-program · CVE-2026-22818

• https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4
• https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134

euvd · EUVD-2026-2017

• https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4
• https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134

nvd · CVE-2026-22818

• https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134
• https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4

osv · GHSA-3vhc-576x-3qv4

• https://github.com/honojs/hono/security/advisories/GHSA-3vhc-576x-3qv4
• https://nvd.nist.gov/vuln/detail/CVE-2026-22818
• https://github.com/honojs/hono/commit/190f6e28e2ca85ce3d1f2f54db1310f5f3eab134
• https://github.com/honojs/hono

No related changes are available here.